Giving Teachers/Heads of Departments Access to Students One Drive

[SeeFights]

Hi all

 

we recently moved to vanilla away from RM and with that we decided to use the students One Drive as their main storage area, this is good for everyone because its less reliant on us and the One Drive is accessible as long as theirs internet so to us there was no end to the benefits however, with RM certain staff had access to just students Home Folders letting said staff go in, get work that was unsubmitted and submit it for them if the work was missing and they needed it.

 

But with the move to vanilla and moving away from Home Folders we lost that teacher access to students home folder. Now i noticed on 365 there is a SharePoint Admin role that we can give staff that gives them the access to create One Drive links via the 365 admin site however, testing this it gave them access to ​everyones​ one drive which if you live in the UK is a huge GDPR issue as we have like a CFO that they can access even the head of schools so we couldn't allow that.

 

I was wondering if theres a way to limit a teachers access to just a security groups users such as Students?

 

If there is no way, how do you all do it?

Edited September 10, 2024 by Dos_Box

[free780]

I did it years ago. You have to make your security group a Sharepoint admin for each Onedrive Sharepoint site. You can use Powershell to do it.

 

Would it be too hard for students to just click share?

[SeeFights]

"Would it be too hard for students to just click share?" - Oh yeah

[Ironside]

Sorry mate I can't think of a way to do what you've asked, but this might be helpful in general.

 

So I've only ever done this for a exam account and it's not going to be as easy as teachers just grabbing files, but if you have the time capacity to take over this from teaching staff, you can:

 

1. Go to M365 Admin Center, then Sharepoint Admin
   
2. Click More Features (sidebar, left)
   
3. Go to User Profiles
   
4. You're now in Old Sharepoint. Go to "Manage User Profiles"
   
5. Type in the username of the profile you need to pull files from into the Find Profiles search box
   
6. Click the listed user, then click "Manage Personal Site".
   
7. You'll be brought to the user's Onedrive.
   

 

There is a in theory easier way - go to M365 admin center, click More Features, go to Users, type in the users naem, then click that name, click OneDrive on the fly-in panel on the right and then create an access link to onedrive - but this never used to work for me.

[SeeFights]

Yeah we can do that when giving the teacher the Sharepoint Admin role in 365 but again, that role gives access to everyones One Drive including other Teachers which is a big GDPR issue.

[psydii]

Students doing work should be doing work in Teams Assignments. Your MIS should be able to link HoD/SLT to courses and your SDS process should be able to mark these HOD/SLT as Owners of the relevant class Teams. Completely solves this problem.

 

(as mentioned above you can do something with Groups and Site Administrators, but this is the wrong way to solve the problem in 2024)

 

This thread should be a useful starting point for a modern Teams Assignments based approach for students digital work:

https://www.edugeek.net/forums/office-software/237668-coursework-teams-onedrive.html

[SeeFights]

Honestly, we should be doing work via Teams as that is something we have set up and accommodate however, kids are...kids and have an even harder time navigating to Teams.

 

My boss the NWM has said that hes mentioned it to Head of IT and told him theyll have to revert back to Teams. No biggie we have Chromebooks

 

Just would of been nice to have this fix for staff as ik staff moral surrounding Teams is ​blows raspberry​

[Ironside]

You should be able to do Teams Assignments with regular windows PCs and teams?

[SeeFights]

we can but the problem is students just find it hard to navigate things so its a pain for us haha

[mavhc]

I did it years ago. You have to make your security group a Sharepoint admin for each Onedrive Sharepoint site. You can use Powershell to do it.

 

Would it be too hard for students to just click share?

 

When you say "for each onedrive sharepoint site", have you split them up?

[psydii]

When you say "for each onedrive sharepoint site", have you split them up?

 

Each user’s OneDrive is in fact its own SharePoint site collection.

[pete]

If you're using Locker, Salamander or SDS and you're creating "teachers of Bob Bobblington, 7B" groups in AD/365 so you can email "teachers of Bob Bobblington 7B" and not spam everyone else, you could use that to set permissions in OneDrive such that only teachers of a student can access that OneDrive.

 

Worth a chat with Salamander/Locker as this is their bread and butter.

[mavhc]

Each user’s OneDrive is in fact its own SharePoint site collection.

 

so the confusion is between giving teachers rights to that sharepoint site, and the sharepoint admin role, which is admin rights to all sharepoint sites?

[psydii]

Yes. Its getting down into the weeds of how SharePoint really works, rather than the dramatically simplified model that 365 presents. Really, Assignments in class Teams are the better option than trying to leverage the "Old Magik" of SharePoint's legacy security model.

[Tefters]

Previous people have already mentioned but it's SharePoint Admin or bust but that's more for high level admins like yourself as it gives access to everything!

 

This is a simple case of use Teams and assignments and train staff and students on how to use the different avenues of Office365 properly.

The problem with this though is that it's not your responsibility as IT to be teaching them how to use Office 365, that's the SLT through CPD and training sessions and even then people still need to learn a bit themselves as Office365 is so big.

 

I have the exact same issue at my place. They needed to start using SharePoint, Teams, OneDrive etc... because they went iPads but no-one knew what to do.

I showed a small handful of people the basics and drew the line at that. Yes I set it all up and manage it, no I am not a teacher nor am paid to teach adults how to use it.

 

My school provide some CPD sessions for staff with the little knowledge they have and muddle their way through but overall do not confidently use it all.

 

The government made a push 2 years ago for all schools to have a digital strategy leader and majority of schools tacked it onto an existing SLT member so not to pay for someone that knew what they were doing or promote a network manager to SLT so... Yeah...

[Squelch]

We get the students to click the share button.

[ThomL]

ChatGPT produced the following code, which seems reasonable on first review:

# Import SharePoint Online Module (Make sure SharePoint Online Management Shell is installed)
Import-Module Microsoft.Online.SharePoint.PowerShell -ErrorAction Stop

# Parameters
$csvPath = "C:\path\to\users.csv"   # Path to the CSV file with user details
$adminGroup = "SecurityGroupName"   # The security group you want to add as Site Collection Admin
$tenantAdminUrl = "https://yourtenant-admin.sharepoint.com"  # Your SharePoint admin URL
$tenantDomain = "yourtenant"   # Your tenant domain

# Connect to SharePoint Online
Connect-SPOService -Url $tenantAdminUrl

# Import users from CSV
$users = Import-Csv -Path $csvPath

foreach ($user in $users) {
   try {
       $userPrincipalName = $user.UserPrincipalName
       Write-Host "Processing OneDrive for user: $userPrincipalName"

       # Get the OneDrive URL for the user
       $onedriveUrl = "https://$tenantDomain-my.sharepoint.com/personal/$($userPrincipalName.Replace('@', '_').Replace('.', '_'))"

       # Add the security group as a Site Collection Admin to the user's OneDrive
       Set-SPOUser -Site $onedriveUrl -LoginName $adminGroup -IsSiteCollectionAdmin $true

       Write-Host "Added $adminGroup as Site Collection Admin for $onedriveUrl" -ForegroundColor Green
   } catch {
       Write-Host "Failed to process OneDrive for user: $userPrincipalName" -ForegroundColor Red
       Write-Host $_.Exception.Message
   }
}

# Disconnect after operation
Disconnect-SPOService

 

CSV would contain student email addresses:

UserPrincipalName

[email protected]

[email protected]

 

You'd create a group to add the members of staff requiring access first and update this in the script as well as the other option that need updating - target a single test user first to hopefully work out kinks, then load up the CSV with all student email addresses once happy it's working.

 

Maybe?

[psydii]

That looks easier than when I had to do it this way: https://alexandervvittig.github.io/2016/11/09/add-a-group-to-site-collection-administrators-for-sharepoint-online/ things have definitely improved in the last few years.

 

We only ran that once, and the last set of students who's onedrive are accessible to Teachers are in year 13 now, and half of them joined after we stopped doing it.

 

Teams Assignments really has been the correct solution for at least the last 5 years.

[CaptainJama]

I created a search page where staff get a direct link to Students OneDrives. Staff are the site collections admins for each Students OneDrives sites.

This is the script I use to add group to Students OneDrive sites

 

Connect-SPOService -url "https://*domain*-admin.sharepoint.com"$csv = Import-Csv -Path (Read-Host -Prompt "Enter Path to Text File")ForEach ( $line in $csv ){ Set-SPOUser -Site $line.OneDriveSite -LoginName "*accountID*" -IsSiteCollectionAdmin $true }